Detections
Analytics

SCA: security update for wagtail (GHSA-xfrw-hxr5-ghqf)

medium Tenable Self-Hosted Container Security Plugin ID 420464

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability
 exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the `{%
 include_block %}` template tag is used to output the value of a plain-text StreamField block (`CharBlock`,
 `TextBlock` or a similar user-defined block derived from `FieldBlock`), and that block does not specify a
 template for rendering, the tag output is not properly escaped as HTML. This could allow users to insert
 arbitrary HTML or scripting. This vulnerability is only exploitable by users with the ability to author
 StreamField content (i.e. users with 'editor' access to the Wagtail admin). Patched versions have been
 released as Wagtail 2.11.8 (for the LTS 2.11 branch), Wagtail 2.12.5, and Wagtail 2.13.2 (for the current
 2.13 branch). As a workaround, site implementors who are unable to upgrade to a current supported version
 should audit their use of `{% include_block %}` to ensure it is not used to output `CharBlock` /
 `TextBlock` values with no associated template. Note that this only applies where `{% include_block %}` is
 used directly on that block (uses of `include_block` on a block _containing_ a CharBlock / TextBlock, such
 as a StructBlock, are unaffected). In these cases, the tag can be replaced with Django's `{{ ... }}`
 syntax - e.g. `{% include_block my_title_block %}` becomes `{{ my_title_block }}`. (CVE-2021-32681)

Solution

Update the wagtail library and its related packages to version 2.11.8 or later.

See Also

https://github.com/advisories/GHSA-xfrw-hxr5-ghqf

Plugin Details

Severity: Medium

ID: 420464

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 8.67

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Low

Base Score: 3.5

Temporal Score: 2.7

Vector: CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS Score Source: CVE-2021-32681

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 5.1

Threat Score: 1.2

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/17/2021

Vulnerability Publication Date: 6/17/2021

Reference Information

CVE: CVE-2021-32681

cwe: CWE-79